Business

NATS outage cost UK economy £33m but was no cyber attack, says CMC

The Cyber Monitoring Centre puts September’s NATS failure at £33m, with airlines bearing most. What it means for dependency risk and cyber insurance.

Chart motif with the headline NATS failure cost UK economy £33m

The Cyber Monitoring Centre has put a price of about £33m on September’s NATS air traffic control failure, and says plainly that no attacker was involved. For security and risk teams, how the incident was costed matters more than what caused it.

What happened

On 4 November 2026 the Cyber Monitoring Centre (CMC), the independent, non-profit body that rates the severity of major technology events hitting UK organisations, published its assessment of the outage at National Air Traffic Services (NATS) on 8 September. Its central estimate is that UK aviation businesses, from airlines and airports to ground handling and tour firms, lost roughly £33m, with a modelled upper bound of about £42m. Bring overseas airlines into the calculation and the figure rises to somewhere between £48m and £76m.

This was not a cyber attack. The CMC found no malicious activity. Ciaran Martin, the former NCSC chief executive who chairs the centre’s technical committee, called it “an accidental technology failure, not a cyber attack”, according to dpa. The CMC placed the event in the lowest band of its five-point severity scale.

Cancellation counts vary: dpa put the total above 2,000 flights, with disruption into the next day, while Infosecurity Magazine cites 1,152 UK-related cancellations, or about 1,800 once overseas airlines are included. Infosecurity Magazine, reporting the CMC’s figures, says about 70 UK organisations were affected and around 450,000 passengers either lost their flight or were delayed by more than two hours. Less than two weeks later a separate NATS problem led to more than 170 further cancellations, and Ryanair called for chief executive Martin Rolfe to go. The Civil Aviation Authority is running its own independent review, and NATS has declined to comment on the CMC’s numbers while that continues.

The detail

NATS published a preliminary report on 18 September at the request of Transport Secretary Heidi Alexander. It traced the fault to a small component of the National Airspace System that hands out identification codes to aircraft. A manual code request was interrupted by a higher-priority message; when processing resumed, a previously unknown defect prevented it from restarting cleanly and corrupted the output, which then polluted later flight data updates. The whole sequence played out inside a single millisecond.

Only flights handled by the London Area Control Centre, mostly above 24,500 feet, were directly affected, yet restrictions had to be imposed across UK airspace so the system could be restarted and flight data reloaded. The CMC says flight data processing was back in roughly three and a half hours, though capacity limits lasted into the evening. NATS put the restrictions at around six hours and said clearing the passenger backlog took more than two days. Rolfe was emphatic that “At no point last week was safety in question.”

Airlines carried more than three quarters of the £33m. NATS itself lost under £1m, in route charges for flights that never flew. The estimate also leaves out several costs: losses at non-UK organisations such as foreign airports, NATS’s investigation costs and whatever it spends on resilience afterwards. Because NATS fixed the system with its own staff, there were no large external repair bills to count.

Key figures from the Cyber Monitoring Centre assessment of the September 2026 NATS outage, including £33m UK losses and airlines' share

Why it matters for UK organisations

The CMC was set up to give insurers, policymakers and businesses an agreed, evidence-based measure of how bad a systemic event really was. Its remit covers incidents with a potential financial impact above £100m that touch multiple organisations, and each rating comes with a free public report. A common yardstick for loss feeds into how underwriters think about aggregation, how event clauses are drafted and how much capacity the market is prepared to offer for technology failures that are not attacks at all.

The NATS case shows the shape of modern operational loss. The organisation whose software failed absorbed a sliver of the cost; the businesses depending on it took almost all of it. That is the same pattern we saw with the CrowdStrike update failure in 2024, a comparison Martin drew himself. If your continuity planning and your cyber insurance assume the big losses come from someone breaking in, an event like this falls straight through the gap. Many cyber policies cover non-malicious system failure only partially, if at all, and dependent business interruption from a supplier you do not contract with directly is often the weakest part of the wording.

There is a regulatory angle too. The Cyber Security and Resilience Bill is intended to widen the scope of the NIS regime and put more weight on resilience and supply chain risk, not just hostile activity. Accidental failures in critical services are squarely within what regulators care about.

Expert view

In my experience the most dangerous phrase in a resilience workshop is “that’s their system, not ours”. The airlines here did nothing wrong, yet they paid for most of the outage. When we run tabletop exercises with clients, the scenario that most often exposes weak planning is not ransomware but a dependency simply stopping: a payment processor, an identity provider, a SaaS platform, a national service.

The CMC’s approach deserves credit. Our industry has long been poor at quantifying harm. A transparent, published estimate, with its exclusions spelled out, is far more useful to a board than a scary headline number. Notice how fast the figure grows once overseas airlines are included; your own impact assessments should state their exclusions just as clearly.

Finally, the root cause is a reminder that legacy code carries latent defects that no amount of perimeter security will touch. The CMC warns the risk of repeats stays elevated while NATS depends on ageing systems. NATS says it has spent well over £1bn on technology in the past decade and wants another £1bn by the end of 2033. Few organisations have that budget, so knowing where legacy risk sits matters even more.

What to do now

  1. Map critical dependencies, including indirect ones. List the external services your revenue depends on within hours, including national infrastructure and suppliers of your suppliers.
  2. Read your insurance wording. Check whether non-malicious system failure and dependent business interruption are covered, the waiting period, and how an event is defined. Talk to your broker before renewal, not after an outage.
  3. Quantify plausible loss. Model a six-hour and a two-day dependency outage in pounds, and document what you have excluded, as the CMC did.
  4. Exercise manual fallback. NATS could revert to manual procedures. Test whether your teams can operate in a degraded mode, and for how long.
  5. Keep the basics strong. Cyber Essentials controls such as secure configuration and security update management will not stop a software defect, but disciplined patching, asset inventory and change control reduce the number of unknowns when something does break.
  6. Track legacy risk on the register. Give ageing systems an owner, a replacement plan and a tested recovery procedure.

Bottom line

A millisecond software fault, no attacker and around £33m of losses, most of it landing on organisations that did not own the failing system. The CMC’s assessment is a useful lesson in pricing technology risk honestly. UK security and risk leaders should treat dependency failure as seriously as intrusion, and make sure their plans and policies do the same.

Sources

Related Posts